This is Planet Money from NPR.
A few weeks ago, I hopped onto a video call with a very special friend of the show.
Just introduce yourself.
Who are you? Who am I?
Oh, come on. I'm your auntie.
This is my Aunt Vovi.
I called her up to talk about an experience she had a few years ago with the genetics testing company, 23andMe.
Fauvi is a lifelong learner.
She loves anthropology and the story of human migration.
So back in 2017 when 23andMe was all the rage, she was interested.
She thought that taking one of their tests might reveal how she fit into the evolutionary sweep of human history.
So was part of the interest about using 23andMe about...
Belonging. Maybe belonging to a much larger collective.
And Vovi knew our family had been in Afghanistan for the last few hundred years.
But she also wondered if this test might reveal the migration route our ancestors had taken out of Africa.
She wondered if it might uncover some long -forgotten tale of star -crossed travelers on the Silk Road.
And so I bought a kit and I convinced some of my friends to do so as well.
Your patient zero. Yeah.
Vovi and I actually talked about this at the time.
By handing over her genome, she was automatically giving this company part of my DNA.
After all we share 25 % of the same genome, and for me, it just wasn't clear what the consequences of all this might be.
But, Vovi's gonna Vovi, and she spent about 100 bucks, spit into a test tube, and sent it off to the company.
And even though she is the most cautious person I know when it comes to putting personal info online, she more or less breezed through 23andMe's terms and conditions.
Yeah, I just said agreed without really reading the fine print.
Well, that's daily life.
It is, who has time for like a 250 page memo?
And when Aunt Vovi's test results arrived, she says they were pretty exciting.
They said we had some Mongolian DNA and a little bit from Yakutsk all the way up in Siberia.
Then, there was this thing that in the 1800s or so, there had been some DNA from Great Britain.
That was a total shock and surprise.
Well there were several wars in Afghanistan in the 1800s.
Yes, and that was sort of a confirmation of, yes, of course these things happened!
A mysterious British interloper in the genome?
This was the kind of hot ancestral goss Vovi had been hoping for.
But then, not too long after, Vovi got an update from 23andMe.
That's because the database was growing.
As the company got more customers and more genetic data points, they were apparently updating their genetic results from time to time.
And the new update had come to a much less complicated conclusion about Vovi's origins.
So it just said that I was 99 .8 % Afghan, basically.
Vovi was a bit taken aback by this.
After this string of intriguing genetic subplots, finding out her genome reflected the one place she'd known about all along, felt a little bit like a letdown.
And the British interloper had disappeared?
Yeah, completely. The British interloper, all the Mongolian markers, you know, all of those disappeared.
And there was actually no indiscretions.
I had been hoping to, for many indiscretions, maybe, uh.
I was hoping for a little more surprise.
And Vovi had been looking for the real housewives of the silk road in her genome.
But at the end of her journey of genetic self discovery, she basically learned I am what I am.
After that Vovi stopped visiting the website and for a few years, she basically forgot about 23andMe.
Until she found out that 23andMe had made her part of a different gene pool.
A group of people whose genetic information is about to go on the market.
When did you first hear that something might be financially awry at 23andMe?
I mean, just last week, I had no idea because, as I said, I haven't gone back to look at anything for a few years now.
Vovi found out, along with the rest of us, that 23andMe had filed for bankruptcy.
And the data on Aunt Vovi's genome, along with the genomes of millions of other 23andMe customers, was potentially up for sale.
And it's not like 23andMe is thinking of selling your shopping preferences for shoes or something.
These are the blueprints our bodies used to build themselves.
And Fovi read that 23andMe's website was crashing because so many customers were rushing to delete their highly sensitive data.
Yeah, it was like a run on the gene bank.
All right, that's right.
All of which obviously raised some big questions for an amphiby.
Like, now that 23andMe was in bankruptcy, was it allowed to just sell her genetic information?
Who'd wanna buy it?
Could that information affect things like insurance premiums?
Could it end up in the hands of law enforcement or a foreign owned company?
And what about the data itself?
How is that gonna be broken into valuable assets?
Was that gonna be sold to the highest bidder?
And how much is my data even worth?
Hello and welcome to Planet Money, I'm Alexei Horwitzkazi.
And I'm Jeff Guo. And Alexei's Aunt Vovi isn't the only one asking these questions these days.
Over the past few decades, some 15 million people have spit into a tube and handed over their entire genome to one Silicon Valley company, which now has one of the biggest genetic databases on earth.
Today on the show, what might happen to Vovi's genetic data as 23andMe works its way through the bankruptcy process and what it all reveals about the data that all of us willingly hand over to companies every single day.
This message comes from NPR sponsor Acura.
The all new Acura ADX is a compact SUV built for versatility.
Available all -wheel drive for weekend escapes, Google built in for seamless connectivity, as well as a Bang & Olufsen premium sound system for high quality audio, the all - new Acura ADX is crafted to match your energy.
Visit Acura .com slash ADX to learn more.
Google is a trademark of Google LLC.
This message comes from ServiceNow, people should do the creative work they actually want to do.
Not boring busy work.
Now with AI agents built into the ServiceNow platform, you can automate millions of repetitive tasks in every corner of your business.
IT, HR, and more, so your people can focus on the work that they want to do.
That's putting AI agents to work for people.
It's your turn. Get started at servicenow .com slash ai -agents.
So to understand what might happen to Aunt Vovi's genetic data and the data of millions of other people, we need to understand exactly how we got here.
how did 23andMe find itself in bankruptcy?
So 23andMe was founded in part on the idea that if they could build a massive database of consumer data, they'd be able to figure out how to monetize it down the road.
And the company was successful at building this data set.
Over the past couple decades, some 15 million customers have sent their DNA to 23andMe.
But the company never figured out a way to make a profit because 23andMe customers were kind of set after they took the test once, and 23andMe's efforts to use all this genetic data to develop and sell new drugs hadn't yet panned out.
Then, in 2023, they were hit with a massive data breach that led to class -action lawsuits.
All these problems helped push the company into bankruptcy.
By the way, we reached out to 23andMe, but they didn't get back to us.
All of which brings us to our next question, what's going to happen to my Aunt Vovi's data now?
See, bankruptcy is a very specific process with some very specific goals.
And how that process plays out here could have a real impact on what ends up happening to Infobie's genetic data.
To get some answers, we called up Laura Cordes, who teaches bankruptcy law at Arizona State University.
What's your favorite bankruptcy?
I don't know. That's like choosing between children or something.
Last month, 23andMe filed for Chapter 11 bankruptcy.
Chapter 11, Laura says, is all about finding ways for a struggling company to stay in business.
It allows a company to hit the pause button on all of its debts and lawsuits and come up with a new plan, either to restructure or to sell itself to someone else.
And the idea behind chapter 11 goes back to the big railroads of the 19th century.
Back then, you had all these different railroad companies that were failing all the time, leaving a lot of debt that they owed to other people, other companies.
So, Congress tried to come up with the best way to get all those creditors paid back, without destroying the actual value of the company.
Because it's going to be much more valuable if we keep it going as a railroad than if we halt everything, halt operations and start like cutting up pieces of track and saying to a creditor okay you get six feet of track.
You get the caboose.
You get the caboose.
You get the caboose.
Anyway, the bankruptcy system is aimed at maximizing the value of the bankrupt company.
And in doing so it's supposed to produce a sort of win win win.
Yeah, the railroad company gets to survive, instead of getting ripped apart and sold for scrap.
Some of the company's employees get to keep their jobs, and some of the customers will continue to get a valuable service, which is, you know, to ride the railroads of America.
and the creditors they will get made as close to whole as possible.
And you can think of the bankruptcy process as this giant trade -off machine.
It's about taking what could be a messy fight between the various parties the company owes money to and forcing everyone to come to an agreement, to compromise.
And in this compromise everyone basically has to accept some losses because as we said the company is often more valuable intact than in pieces and if that means that some contracts are not honored or some pool of investors don't get paid back, well, that is just the cost of not going out of business.
In the case of 23andMe, the potentially really -valuable asset isn't railroad lines – it's genetic data from customers like Aunt Vovi.
Now, the United States doesn't really have strong federal laws protecting privacy.
Europe and some states like California and Illinois do.
But what 23andMe customers do have is a contract with the company.
They have this privacy agreement where they were promised certain protections.
So one of the big questions here is how will those privacy protections fair in the thunderdome of the bankruptcy process?
Is this the first time that bankruptcy law met consumer data privacy?
No, not at all. This has been going on for a while.
Laura says there's one particularly important case from back in the year 2000, when consumer data privacy and the bankruptcy system collided, a case that sort of set the foundation for the rules around these data sales.
Is it Toys Smart or Toys Mart?
I always think of it as Toys Smart, like smart toys.
Toy smarter, not harder.
Yeah. Toy Smart was an online toy retailer that crashed when the dot -com bubble burst. As part of their bankruptcy filings the company announced its intention to sell off the names and contact information of its customers.
Those lists could be valuable to other companies trying to find their own new customers.
But that announcement raised two big problems. First, Toysmart's Terms of Service had expressly promised its customers that their data would not be sold to any third parties.
And second, Toysmart's customer lists contain details about, you know, some of the kids who got toys there.
There's this concern about we're going to be selling the data of children to potentially anybody, right?
Not even necessarily a toy manufacturer.
And I think that raised a lot of red flags.
In light of those red flags, the Federal Trade Commission, which is one of the main consumer protection agencies, they sued to block the proposed sale of that data.
They said that Toy Smart was breaking their privacy policy and engaging in a deceptive business practice.
Eventually though, the FTC and Toy Smart came to a settlement.
A set of conditions under which the company would be allowed to sell its customer data.
The FTC did want bankrupt companies to be able to maximize their value, but they also didn't want customers to suffer too much harm by letting Toy Smart break their data privacy promise.
So they came up with this new trade -off.
To let Toy Smart sell its customer data, but with a few guardrails, a few conditions.
Condition number one?
The customer information can't be sold by itself, it has to be sold as part of the Toy Smart business.
Condition number 2 was that ToySmart was only allowed to sell the data to a company in a related industry that agreed to uphold the terms of the original privacy policy.
This is what the FTC called a qualified buyer.
The thinking was customers have given up their data in order to improve their toy buying experience so they shouldn't have to worry about how it might be used by some other kind of company.
In striking this deal, the ToySmart case kind of set a precedent.
It had already been a norm in bankruptcy that contracts with vendors or employees or creditors could be renegotiated.
ToySmart established that, in the interest of maximizing value, consumer data privacy was also something that could be on the negotiating table.
And so these ToySmart guidelines kind of became the blueprint for other companies seeking to sell their data in bankruptcy.
And I think today, data sales and bankruptcy adopt a lot of the facets of the ToySmart settlement.
So, in the case of 23andme, the question of whether or not the company is allowed to sell my Aunt Vovi's genome is much clearer.
In the years after ToySmart, it became a pretty standard practice for companies to reserve the right to sell customer data in case of bankruptcy.
And that language was right in the privacy policy that Vovi kind of ignored when she signed up.
So it looks like Antvoevy's data unfortunately is going to be sold in this bankruptcy process.
Now 23andMe has already said that any potential buyers will have to uphold their current privacy policy.
But the shape of that final deal?
That will be determined by a bigger negotiation.
Now consumers are not generally invited to the bankruptcy negotiating table.
So Antvoevy won't be getting a seat here.
But Laura says often there is a dedicated person tasked by the bankruptcy with advocating on behalf of consumers' privacy rights.
Yes, the Consumer Privacy Ombudsman, or the CPO, is what they're called.
We love our acronyms in bankruptcy.
Same at Planet Money or PM as we sometimes call it.
We really do, A -H -G.
Anyway, the CPO, or the Consumer Privacy Ombudsman, this was a position created by Congress about 20 years ago.
It was a time when more and more companies were building their businesses around collecting consumer data, And, as some of these companies went under, more and more of these datasets were ending up on the bankruptcy auction block.
The Toy Smart case had established some rough guidelines for these situations.
But in subsequent cases, it became clear that no one in the bankruptcy system really had the expertise or incentives to dedicate themselves to, you know, scrutinizing the privacy implications of selling any particular kind of customer data.
The CPO offered a way for the bankruptcy court to appoint a data privacy specialist, who could check the fine print of the company's privacy agreements, cross -reference privacy laws, and then come up with recommendations for how to structure a deal that might reduce any harms to the consumer.
Because consumers for the most part aren't parties to a bankruptcy case, but they are affected by what happens in a bankruptcy case, especially when their data is being sold.
And so the role of the CPO is to try to be that voice, I think, for consumers.
Since the position was created, CPOs have been brought into dozens of bankruptcies involving the sale of customer data, from the Circuit City bankruptcy to General Motors to Borders books.
Laura says one example of the impact a CPO can have on one of these cases is the RadioShack bankruptcy from 2015.
RadioShack had a ton of customers, over 100 million.
It was like a significant percentage of the entire US population.
It was in fact about a third of the US population whose personal data RadioShack was proposing to sell.
An ombudsman named Elise Frejka was brought in to evaluate privacy concerns, and the plans she came up with did end up making a big difference.
The biggest recommendation that Frejka gave had to do with the amount of data being sold.
She argued that instead of selling the data for every RadioShack customer ever, the sales should only apply to customers who had been in contact with the company in the past two years.
So I mean you could argue that that's an effective use of the CPO or an effective use of privacy protections, because if your last interaction with RadioShack was like ten years prior to the bankruptcy, your data was not getting sold, that was not part of the sale.
So this is an example of the CPO system kind of pushing back against the initial proposal to sell this huge swath of customer data.
Exactly. Now some critics have argued that the consumer protection the CPO really offers is mostly performative.
CPOs are generally brought in at the tail end of the bankruptcy process, after a prospective buyer has already been chosen.
They're often given as little as seven days to do their research and submit a report to the court.
And their recommendations to the bankruptcy judge are just recommendations.
They are non -binding.
But whether or not any of this is performative, the CPO process can also be really expensive.
And so there's also a lot of pressure against appointing a CPO at all.
The CPO, I should mention, is being paid by the bankruptcy estate.
And so the money that is going towards the CPO's work in terms of gathering all this information and making this report is coming out of funds that could potentially go to creditors.
So in a lot of cases, a bankrupt company's creditors, the people who are owed money, they don't necessarily want the CPO cause it might mean a smaller payout for them.
And the bankrupt company itself often doesn't want a CPO because it could slow down the sale process and make their portfolio of assets less valuable to potential buyers.
The default here is that there is no CPO unless a privacy policy is being expressly broken in a sale.
If some party in the bankruptcy requests a CPO, then it's up to the court to decide to appoint one.
In the case of 23andMe, the company's lawyers argued that they should be allowed to skip the CPO and just hire their own private privacy monitor.
But the Texas Attorney General and the federal watchdog over the bankruptcy process have pushed back, saying no. Given this highly sensitive data, the case should get its own official ombudsman.
So now it is up to the bankruptcy court to decide.
OK, so that is the basic framework that a bankruptcy court is using to sell Ant -Vovee's genome.
After the break, who might actually end up buying 23andMe's genetic database?
Could it be a foreign -owned tech company, a law enforcement agency?
Oh, no. And will Aunt Vovi choose to stay or to delete her genetic data forever?
Okay, so we've learned about how private consumer data has been sold in bankruptcy in the past. To understand how the bankruptcy court will settle on a buyer for 23andMe, we called up Melissa Jacoby.
She's a professor of bankruptcy law at the University of North Carolina.
And the author of a book, Unjust Debts, How Our Bankruptcy System Makes America More Unequal.
And just keep in mind, you're talking to me as if we're at a bar.
You don't think I talk at a bar like a robot?
I have no idea what you're talking about.
If a company decides to use chapter 11 bankruptcy to sell itself off to a new buyer, Melissa reminds us that a big part of the process is about finding the right kind of buyer who will pay, you know, the highest price.
23andMe has already proposed a set of conditions for who will be eligible to bid here, several of which follow the ToySmart settlement.
A qualified bidder can't buy the genetic dataset on its own, and...
The qualified bidder has to promise that they are going to keep the privacy commitments that 23andMe had going into this bankruptcy case intact.
Okay, let's dive into those commitments.
I'm getting out my printed copy of 23andMe's privacy agreement.
Bring it with me everywhere now.
So this is the document where 23andMe reserved its right to sell Vovi and everybody else's data.
But this agreement also gives customers some protections that will be relevant to the sale and what happens after.
It promises that the company will not share their data with law enforcement, unless legally mandated, And it gives the customers the right to delete their information at any time and to have their saliva samples destroyed.
A new buyer would have to honor all of that to qualify.
Which brings us back to Aunt Vovi's question about who might buy this data and whether she should be worried.
We talked through some options with Melissa, and she reminded us that a bankruptcy acquisition is still subject to all sorts of legal scrutiny.
It still has to comply with the law.
And by the law, I don't just mean bankruptcy law, but I do mean all the other oversights that come from privacy law, antitrust, foreign security concerns and the like.
We asked Melissa about some of the more dystopian potential buyers.
For example, could a Chinese tech company with ties to the Chinese Communist Party put in a bid for 23andMe and get access to its genetic database?
case, Kentucky Congressman James Comer recently raised this concern and opened a house oversight investigation into the 23 and Me bankruptcy.
Melissa says, okay that question would likely fall to the Committee on Foreign Investment in the United States, or CFIUS as we acronym obsessives like to call it.
Actually everyone calls it that.
This agency vets foreign investments in the U .S. for national security concerns, and it can recommend that a deal be blocked.
Okay, next up, could a law enforcement agency like the FBI or the NSA buy the data from these 15 million genomes?
There isn't anything in the bankruptcy code expressly forbidding this kind of sale, but this option seems like it would potentially violate 23andMe's privacy agreement, which promises—unless required by law—not to share genetic information with law enforcement.
As for, you know, the more likely bidders in this case, at this point, we know that 23andme's co -founder and former CEO, Ann Wojcicki, has expressed interest in buying the company.
In fact, she stepped down as CEO last month with the stated goal of making a bid for it in bankruptcy.
And a few other companies have expressed interest. A genetic testing company called Nucleus Genomics, for one, along with a crypto non -profit that posted on X that it wanted to return American's intellectual property back to them, including their DNA.
B, but there's another way of looking at Aunt Voelje's question about whether or not she should be worried.
Because no matter who buys 23 and Me, there's still the question of what they could do with all this genetic data.
Like, what do the actual laws say?
Legally speaking, what could a new owner get away with?
And what's not allowed?
To hear about some of the best and worst case scenarios, we called up one last expert.
Harvard law professor, and bio -ethicist Glenn Cohen.
The happy scenario is it's bought by another company that's even more public -spirited and even more privacy -sensitive and even more cyber -secure than 23andMe is, and then, actually, guess what?
You got an upgrade in terms of your protection.
Other happy scenarios?
Maybe some 23andMe competitor buys up this data, combines it with their own genetic database, and is able to offer even more comprehensive genealogy services.
Or there's a world in which these databases eventually help lead to groundbreaking scientific discoveries or where they help develop new medicines and treatments.
But there's also a world in which the company that ends up buying 23andMe's genetic database ends up sharing it with third parties or using it in ways that its customers probably wouldn't have agreed to when they you know originally spit into those tubes and sent them in.
The negative story is that it's sold by someone who you know initially agrees to abide by the 23andMe privacy statement, but privacy statements can change and then changes it pretty rapidly.
And one would hope that the company would offer you an opportunity to opt out, but guess what?
I get a million of these privacy statement kind of notifications all the time.
And I often just ignore them or click through or don't realize there's something I'm supposed to do.
In other words, a new buyer could change the privacy policy, they could allow more open access to law enforcement or share the data with insurance companies, or even revoke the right of consumers to delete their data.
Former 23andMe customers would likely get the opportunity to either opt -in or opt -out, but we all know what it's like to get an email from some company about their new terms of service.
Delete. But even if a new buyer changes the privacy policy, it's not like they could just do anything with Antfovie's data.
Glenn says there are some legal protections that might apply here.
Now, Ant -Vovee's genetic data is not considered privileged health information, which would be covered by HIPAA.
That's because HIPAA is for healthcare providers, like doctors and hospitals, not consumer -facing companies like 23andMe.
But he explained that there is one federal law that is meant to prevent abuses of specifically this kind of genetic data.
It's called the Genetic Information Non -Discrimination Act, or GINA.
So if for some reason if your information was shared with your employer, right?
So it's to say you have a predisposition towards Alzheimer's for example, right?
That would be the kind of thing that if an employer tried to act on it, the Genetic Information Non -Discrimination Act, GINA, might prevent them from discriminating.
You could bring a lawsuit, just as you could for racial discrimination or other kinds of discrimination.
That's a practical protection.
The same goes for health insurance.
GINA prohibits health insurance companies from setting their premiums or denying coverage based on your genetic information.
So if a 23andMe buyer were to share your genetic data with your health insurer, they couldn't just kick you off their plan based on the fact you have certain genes.
Still, Glenn points out that Gena is a relatively narrow law.
It does not apply to life insurance or disability insurance.
Those companies could still potentially change their coverage based on this genetic information.
And also there are just still a lot of unknown potential consequences to allowing your genetic data to circulate on the market.
So when Glenn talks to people like my Aunt Vovi, about whether or not to delete their 23andMe data, he says they should keep in mind, there is a very real trade -off here.
Ask yourself whether you feel as though you've gotten the benefit or what you hope from the product now.
You don't think there's much more you're intending to get out of it.
You might consider deleting your account.
Now of course, that's going to terminate the ability for people to use it to develop drugs and therapeutics, right?
So there's a downside to this and I don't want people just to do this willy -nilly, but think about whether you feel like you want to have an ongoing relationship with this company or the possibility of success your company.
As of now multiple state attorneys general have issued public statements encouraging 23 and Me customers to forego all of these risks by deleting their genetic data immediately.
And huge numbers of customers seem to have taken them up on it.
In the week following the bankruptcy announcement, 23andMe's website apparently crashed and many users found it difficult or impossible to delete their data.
Which puts 23andMe in this kind of ironic position, right?
The very same customer privacy policy that gave them the right to sell their customers' data also gives their customers the right to, you know, delete themselves.
And every customer that removes themselves from this database makes it a tiny bit less valuable as an asset in bankruptcy, Which, for 23andMe, makes closing this bankruptcy sale as quickly as possible even more urgent.
Last week, I ran all the stuff we'd learned by my Aunt Vovi.
The protections of the bankruptcy system, the promise of the consumer privacy ombudsman, as well as where her data could end up.
So knowing all this, what do you want to do with your 23andMe data?
Yeah. I just don't want the possibility that my data would get into the wrong hands, so let's delete it.
I mean, make it all go away.
And with that, Bovy and I were off to 23andMe's website to tell them that it was time to, let my genome go.
We just go into your settings.
Settings. And scroll all the way down to the bottom.
Memberships, preferences.
Get a reward. No, don't be tricked.
No. A reward? It just popped at me.
Okay, now I'm in delete your data.
After a couple hurdles, we found ourselves staring down a giant red delete button.
It's right here. Why are you requesting to delete your data?
What would you put in there?
I don't trust you anymore.
Sorry 23andme. Yeah, you messed up.
For a moment, Phobey just kind of hovered over the bun.
How are you feeling?
Are you feeling nervous?
Oh, no, not at all.
Should we do it? Let's do it, Phove.
OK. Hold my hand. Yes, your virtual hand.
OK, countdown. In three, two, one.
Press. OK, now I have a new screen.
Your data is being deleted.
Hey. Now, it will still take a little time for the company to actually destroy the physical saliva sample that Bobi sent in to start her genetic journey.
In the meantime, she says she'll think twice before breezing through the next privacy agreement she encounters, because these days you never know what intimate personal data might end up on the bankruptcy auction block.
For listeners out there who are new to Planet Money, first of all, welcome.
Second, check out the rest of the Feedfirst stories on Canadian tariffs, why many economists hate the idea of the president firing a Federal Reserve chair, or why everybody and their pet squirrel seem to have a meme coin these days.
This episode was produced by Sylvie Douglas, it was edited by Jess Jang, fact -checked by Tyler Jones, and engineered by Harry Paul and Neil Rauch. Alex Goldmark is our executive producer.
Special thanks to Sara Gerkey and Elise Frakin.
I'm Alexey Horowitz -Gosze.
And I'm Jeff Guo, this is NPR, thanks for listening.
